Timeline for How to safely use password-protected websites on internet cafe computers
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 20, 2016 at 12:46 | comment | added | hildred | (cont) but challenge response is fairly complicated to securely implement in this use case in that the public computer cannot be used to do any of the calculations involved. | |
| Sep 20, 2016 at 12:43 | comment | added | hildred | @Berwyn, the advantage 2fa has is that by having multiple credentials compromising one is not a total compromise, however for this specific use case every authentication method is vulnerable to compromise. Therefore for this case you want to only use credentials that are disposable so that the compromise of the credentials does not matter. That is why I recommend OTP only for this use case. A second credential of a different type would be of value if we could find another that was not vulnerable to instant compromise. the only other candidate that I am aware of is a challenge response (cont) | |
| Sep 20, 2016 at 5:08 | comment | added | Fattie | Yes, in a sense 1F is better than 2F, because the overwhelming issue is the human factor. If you're about to be MITM en route to your luxembourg bank for naive users (ie, 99.999999999999999999999999999999999999999999999999999999% of living humans) the 2F is an illusion. To put it more simply, 2F is convincing people it's OK to use really insecure physical devices. All the talk about password capture on here by non-experts is a good example: there's heaps of badness that can happen to you if you connect to your bank (or even just email) and they DON'T get your passwords; it's all a bit silly. | |
| Sep 20, 2016 at 3:26 | comment | added | Berwyn | So you're saying 1FA is better than 2FA then? ;) | |
| Sep 20, 2016 at 0:16 | history | answered | hildred | CC BY-SA 3.0 |